feat(07-01): add bcrypt, locale override, and validation rules

Co-authored-by: Cursor <cursoragent@cursor.com>

bouncer/password.go

@@ -0,0 +1,27 @@
+package bouncer
+
+import "golang.org/x/crypto/bcrypt"
+
+// HashPassword returns a bcrypt hash of plain at the given cost.
+func HashPassword(cost int, plain string) (string, error) {
+	b, err := bcrypt.GenerateFromPassword([]byte(plain), cost)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// CheckPassword reports whether plain matches hash. A malformed hash returns false.
+func CheckPassword(hash, plain string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
+}
+
+// NeedsRehash reports whether hash was produced below configuredCost.
+// A hash bcrypt cannot parse needs a rehash.
+func NeedsRehash(hash string, configuredCost int) bool {
+	cost, err := bcrypt.Cost([]byte(hash))
+	if err != nil {
+		return true
+	}
+	return cost < configuredCost
+}